mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-05-08 14:36:13 +00:00
10ebc6cbdc
* Implement CSRF protection and security hardening across the application - Added CSRF token handling in axios requests and HTML templates. - Introduced CSRF middleware to validate tokens for unsafe HTTP methods. - Implemented login limiter to prevent brute-force attacks. - Enhanced security headers in middleware for improved response security. - Updated login notification to include safe metadata without passwords. - Added tests for CSRF middleware and login limiter functionality. * fix
37 lines
1.2 KiB
JavaScript
37 lines
1.2 KiB
JavaScript
axios.defaults.headers.post['Content-Type'] = 'application/x-www-form-urlencoded; charset=UTF-8';
|
|
axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';
|
|
|
|
axios.interceptors.request.use(
|
|
(config) => {
|
|
config.headers = config.headers || {};
|
|
const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
|
|
const method = (config.method || 'get').toUpperCase();
|
|
if (csrfToken && !['GET', 'HEAD', 'OPTIONS', 'TRACE'].includes(method)) {
|
|
config.headers['X-CSRF-Token'] = csrfToken;
|
|
}
|
|
if (config.data instanceof FormData) {
|
|
config.headers['Content-Type'] = 'multipart/form-data';
|
|
} else {
|
|
config.data = Qs.stringify(config.data, {
|
|
arrayFormat: 'repeat',
|
|
});
|
|
}
|
|
return config;
|
|
},
|
|
(error) => Promise.reject(error),
|
|
);
|
|
|
|
axios.interceptors.response.use(
|
|
(response) => response,
|
|
(error) => {
|
|
if (error.response) {
|
|
const statusCode = error.response.status;
|
|
// Check the status code
|
|
if (statusCode === 401) { // Unauthorized
|
|
return window.location.reload();
|
|
}
|
|
}
|
|
return Promise.reject(error);
|
|
}
|
|
);
|